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Abstract 

In this paper wc present a new pseudorandom number generator (PRNG) on graphics processing units 
(GPU). This PRNG is based on the so-called chaotic iterations. It is firstly proven to be chaotic according 
to the Devaney's formulation. We thus propose an efficient implementation for GPU that successfully 
passes the BigCrush tests, deemed to be the hardest battery of tests in TestUOl. Experiments show that 
this PRNG can generate about 20 billion of random numbers per second on Tesla C1060 and NVidia 
GTX280 cards. It is then established that, under reasonable assumptions, the proposed PRNG can be 
cryptographically secure. A chaotic version of the Blum-Goldwasser asymmetric key encryption scheme 
is finally proposed. 

1 Introduction 

Randomness is of importance in many fields such as scientific simulations or cryptography. "Random num- 
bers" can mainly be generated either by a deterministic and reproducible algorithm called a pseudorandom 
number generator (PRNG), or by a physical non-deterministic process having all the characteristics of a 
random noise, called a truly random number generator (TRNG). In this paper, we focus on reproducible 
generators, useful for instance in Monte-Carlo based simulators or in several cryptographic schemes. These 
domains need PRNGs that are statistically irreproachable. In some fields such as in numerical simulations, 
speed is a strong requirement that is usually attained by using parallel architectures. In that case, a recurrent 
problem is that a deflation of the statistical qualities is often reported, when the parallelization of a good 
PRNG is realized. This is why ad-hoc PRNGs for each possible architecture must be found to achieve both 
speed and randomness. On the other side, speed is not the main requirement in cryptography: the great need 
is to define secure generators able to withstand malicioTis attacks. Roughly speaking, an attacker should not 
be able in practice to make the distinction between numbers obtained with the secure generator and a true 
random sequence. Finally, a small part of the community working in this domain focuses on a third require- 
ment, that is to define chaotic generators. The main idea is to take benefits from a chaotic dynamical system 
to obtain a generator that is unpredictable, disordered, sensible to its seed, or in other word chaotic. Their 
desire is to map a given chaotic dynamics into a sequence that seems random and unassailable due to chaos. 
However, the chaotic maps used as a pattern are defined in the real line whereas computers deal with finite 
precision numbers. This distortion leads to a deflation of both chaotic properties and speed. Furthermore, 
authors of such chaotic generators often claim their PRNG as secure due to their chaos properties, but there 
is no obvious relation between chaos and security as it is understood in cryptography. This is why the use 
of chaos for PRNG still remains marginal and disputable. 

The authors' opinion is that topological properties of disorder, as they are properly defined in the math- 
ematical theory of chaos, can reinforce the quality of a PRNG. But they are not substitutable for security 
or statistical perfection. Indeed, to the authors' mind, such properties can be useful in the two following 
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situations. On the one hand, a post-treatment based on a chaotic dynamical system can be applied to a 
PRNG statistically deflective, in order to improve its statistical properties. Such an improvement can be 
found, for instance, in ^|2j. On the other hand, chaos can be added to a fast, statistically perfect PRNG 
and/or a cryptographically secure one, in case where chaos can be of interest, only if these last properties 
are not lost during the proposed post-treatment. Such an assumption is behind this research work. It leads 
to the attempts to define a family of PRNGs that are chaotic while being fast and statistically perfect, or 
cryptographically secure. Let us finish this paragraph by noticing that, in this paper, statistical perfection 
refers to the ability to pass the whole Big Crush battery of tests, which is widely considered as the most strin- 
gent statistical evaluation of a sequence claimed as random. This battery can be found in the well-known 
TestUOl package [T3]. Chaos, for its part, refers to the well-established definition of a chaotic dynamical 
system proposed by Devaney |10| . 

In a previous work |21 H] we have proposed a post-treatment on PRNGs making them behave as a chaotic 
dynamical system. Such a post-treatment leads to a new category of PRNGs. We have shown that proofs of 
Devaney's chaos can be established for this family, and that the sequence obtained after this post-treatment 
can pass the NIST [7], DieHARD [14 , and TestUOl [14 batteries of tests, even if the inputted generators 
cannot. The proposition of this paper is to improve widely the speed of the formerly proposed generator, 
without any lack of chaos or statistical properties. In particular, a version of this PRNG on graphics 
processing units (GPU) is proposed. Although GPU was initially designed to accelerate the manipulation 
of images, they are nowadays commonly used in many scientific applications. Therefore, it is important 
to be able to generate pseudorandom numbers inside a GPU when a scientific application runs in it. This 
remark motivates our proposal of a chaotic and statistically perfect PRNG for GPU. Such device allows us to 
generate almost 20 billion of pseudorandom numbers per second. Furthermore, we show that the proposed 
post-treatment preserves the cryptographical security of the inputted PRNG, when this last has such a 
property. Last, but not least, we propose a rewriting of the Blum-Goldwasser asymmetric key encryption 
protocol by using the proposed method. 

The remainder of this paper is organized as follows. In Section [2] we review some GPU implementations 
of PRNGs. Section [3] gives some basic recalls on the well-known Devaney's formulation of chaos, and on an 
iteration process called "chaotic iterations" on which the post-treatment is based. The proposed PRNG and 
its proof of chaos are given in Section [4j Section [5] presents an efficient implementation of this chaotic PRNG 
on a CPU, whereas Section |6] describes and evaluates theoretically the GPU implementation. Such generators 
are experimented in Section [7] We show in Section [8] that, if the inputted generator is cryptographically 
secure, then it is the case too for the generator provided by the post-treatment. Such a proof leads to the 
proposition of a cryptographically secure and chaotic generator on GPU based on the famous Blum Blum 
Shum in Section [9?T| and to an improvement of the Blum-Goldwasser protocol in Sect. |9.2] This research 
work ends by a conclusion section, in which the contribution is summarized and intended future work is 
presented. 

2 Related works on GPU based PRNGs 

Numerous research works on defining GPU based PRNGs have already been proposed in the literature, 
so that exhaustivity is impossible. This is why authors of this document only give reference to the most 
significant attempts in this domain, from their subjective point of view. The quantity of pseudorandom 
numbers generated per second is mentioned here only when the information is given in the related work. A 
million numbers per second will be simply written as IMSample/s whereas a billion numbers per second is 
IGSample/s. 

In [18J a PRNG based on cellular automata is defined with no requirement to an high precision integer 
arithmetic or to any bitwise operations. Authors can generate about 3.2MSamples/s on a GeForce 7800 
GTX GPU, which is quite an old card now. However, there is neither a mention of statistical tests nor any 
proof of chaos or cryptography in this document. 

In [T], the authors propose different versions of efficient GPU PRNGs based on Lagged Fibonacci or 
Hybrid Taus. They have used these PRNGs for Langevin simulations of biomolecules fully implemented on 
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GPU. Performances of the GPU versions are far better than those obtained with a CPU, and these PRNGs 
succeed to pass the BigCrush battery of TestUOl. However the evaluations of the proposed PRNGs are only 
statistical ones. 

Authors of have studied the implementation of some PRNGs on different computing architectures: 
CPU, field-programmable gate array (FPGA), massively parallel processors, and GPU. This study is of in- 
terest, because the performance of the same PRNGs on different architectures are compared. FPGA appears 
as the fastest and the most efficient architecture, providing the fastest number of generated pseudorandom 
numbers per joule. However, we notice that authors can "only" generate between 11 and 16GSamples/s with 
a GTX 280 GPU, which should be compared with the results presented in this document. We can remark 
too that the PRNGs proposed in [5D] are only able to pass the Crush battery, which is far easier than the 
Big Crush one. 

Lastly, Cuda has developed a library for the generation of pseudorandom numbers called Curand (17] . 
Several PRNGs are implemented, among other things Xorwow jTS] and some variants of Sobol. The tests 
reported show that their fastest version provides 15GSamples/s on the new Fermi C2050 card. But their 
PRNGs cannot pass the whole TestUOl battery (only one test is failed). 

We can finally remark that, to the best of our knowledge, no GPU implementation has been proven to 
be chaotic, and the cryptographically secure property has surprisingly never been considered. 

3 Basic Recalls 

This section is devoted to basic definitions and terminologies in the fields of topological chaos and chaotic 
iterations. 

3.1 Devaney's Chaotic Dynamical Systems 

In the sequel 5" denotes the n*'' term of a sequence S and Vi denotes the i*'' component of a vector 
V . Z*^ = / o ... o / is for the fc*'' composition of a function /. Finally, the following notation is used: 
[l;iVl ={l,2,...,iV}.^ 

Consider a topological space {X ,t) and a continuous function f : X X . 

Definition 1 / is said to be topologically transitive if, for any pair of open sets U,V d X , there exists A; > 
such that f''{U)nV ^ 0. 

Definition 2 An element x is a periodic point for / of period n G IN* if /"(a;) = x. 

Definition 3 / is said to be regular on {X, r) if the set of periodic points for / is dense in X: for any point 
X in X , any neighborhood of x contains at least one periodic point (without necessarily the same period). 

Definition 4 (Devaney's formulation of chaos [10]) / is said to be chaotic on {X,t) if / is regular 
and topologically transitive. 

The chaos property is strongly linked to the notion of "sensitivity", defined on a metric space {X,d) by: 

Definition 5 / has sensitive dependence on initial conditions if there exists 5 > such that, for any x € X 
and any neighborhood V of x, there exist y £ V and n > such that d (/"(x), /"(y)) > S. 
S is called the constant of sensitivity of /. 

Indeed, Banks et al. have proven in [6 that when / is chaotic and (A", d) is a metric space, then / has the 
property of sensitive dependence on initial conditions (this property was formerly an element of the definition 
of chaos). To sum up, quoting Devaney in jTU], a chaotic dynamical system "is unpredictable because of the 
sensitive dependence on initial conditions. It cannot be broken down or simplified into two subsystems which 
do not interact because of topological transitivity. And in the midst of this random behavior, we nevertheless 
have an element of regularity". Fundamentally different behaviors are consequently possible and occur in an 
unpredictable way. 
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3.2 Chaotic Iterations 



Let us consider a system with a finite number N £ M* of elements (or cells), so that each cell has a Boolean 
state. Having N Boolean values for these cells leads to the definition of a particular state of the system. A 
sequence which elements belong to |1; N] is called a strategy. The set of all strategies is denoted by |1, N]''^. 

Definition 6 The set B denoting {0, 1}, let / : — ^ Bi^ be a function and S £ |1, N]"^ be a "strategy". 
The so-called chaotic iterations are defined by x^^ £ B^ and 

In other words, at the n*'' iteration, only the S*"— th cell is "iterated". Note that in a more general 
formulation, S*" can be a subset of components and (/(a;"^^))g„ can be replaced by {f{x''))g„, where 
k < n, describing for example, delays transmission P^Hl H]. Finally, let us remark that the term "chaotic", in 
the name of these iterations, has a priori no link with the mathematical theory of chaos, presented above. 

Let us now recall how to define a suitable metric space where chaotic iterations are continuous. For 
further explanations, see, e.g., [1]. 

Let S be the discrete Boolean metric, S{x,y) = ^ x = y. Given a function /, define the function: 

Ff : II; N] X B^ — > 

(2) 



{k,E) ^ (^E,.S{k,j) + fiE)k.S{k,j)) 



where + and . are the Boolean addition and product operations. Consider the phase space: 

A' = |l;Nl^xB^, (3) 

and the map defined on X: 

GfiS,E)^{a{S),FMS),E)), (4) 

where cr is the shift function defined by a{S")neM e |1, N]** — > {S"^^)neK e p, Nj^ and i is the initial 
function i : {S^)neK G [1, N]'^ — > S'^ £ |1; N]. Then the chaotic iterations proposed in Definition [g] can be 
described by the following iterations: 

/ ^° ^ f5) 
I X^+i = G/(X'=). 

With this formulation, a shift function appears as a component of chaotic iterations. The shift function 
is a famous example of a chaotic map [101 but its presence is not sufficient enough to claim G/ as chaotic. 
To study this claim, a new distance between two points X = {S, E),Y = {S, E) £ X has been introduced in 
[1] as follows: 

d{X,Y) =d,{E,E) + ds{S,S), (6) 



where 



N 

de{E,E) = Y.^(^k,Ek), 

(7) 



ds{S, S) 



9 ^ 15"=^ -5"=^! 

k=l 



This new distance has been introduced to satisfy the following requirements. 

• When the number of different cells between two systems is increasing, then their distance should 
increase too. 
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• In addition, if two systems present the same cells and their respective strategies start with the same 
terms, then the distance between these two points must be small because the evolution of the two 
systems will be the same for a while. Indeed, both dynamical systems start with the same initial 
condition, use the same update function, and as strategies are the same for a while, furthermore 
updated components are the same as well. 

The distance presented above follows these recommendations. Indeed, if the floor value [d{X, Y)\ is equal 
to n, then the systems E,E differ in n cells (de is indeed the Hamming distance). In addition, d{X,Y) — 
[d{X, Y)\ is a measure of the differences between strategies S and S. More precisely, this floating part is 
less than 10^*^ if and only if the flrst k terms of the two strategies are equal. Moreover, if the A:*'' digit is 
nonzero, then the A;*'* terms of the two strategies are different. The impact of this choice for a distance will 
be investigated at the end of the document. 
Finally, it has been established in [4 that, 

Proposition 1 Let f be a map from to itself. Then Gf is continuous in the metric space {X,d). 

The chaotic property of G/ has been flrstly established for the vectorial Boolean negation f{xi, . . . ,xm) = 
{xi, . . . ,X[^) |4j. To obtain a characterization, we have secondly introduced the notion of asynchronous 
iteration graph recalled bellow. 

Let / be a map from to itself. The asynchronous iteration graph associated with / is the directed 
graph r(/) deflned by: the set of vertices is B^; for all x e B'^ and i e |1; N], the graph r(/) contains an 
arc from x to Ff{i, x). The relation between r(/) and G/ is clear: there exists a path from x to x' in r(/) if 
and only if there exists a strategy s such that the parallel iteration of G f from the initial point (s, x) reaches 
the point x' . We have then proven in [2. that. 

Theorem 1 Let f : B'^ — > B^. Gf is chaotic (according to Devaney) if and only if T{f) is strongly 
connected. 

Finally, we have established in [5^ that. 
Theorem 2 Let f : B" B", r(/) its iteration graph, M its adjacency matrix and M a n x n matrix 
defined by Alij = ^^hj if i ^ j o,nd Ma = 1 — ^ ^ Alij otherwise. 

If T{f) is strongly connected, then the output of the PRNG detailed in Algorithm^ follows a law that 
tends to the uniform distribution if and only if M is a double stochastic matrix. 

These results of chaos and uniform distribution have led us to study the possibility of building a pseudoran- 
dom number generator (PRNG) based on the chaotic iterations. As G/, defined on the domain |1; N]''^ x B'^, 
is built from Boolean networks / : B^ ^ B^, we can preserve the theoretical properties on G/ during imple- 
mentations (due to the discrete nature of /). Indeed, it is as if B^ represents the memory of the computer 
whereas |1; N]"^ is its input stream (the seeds, for instance, in PRNG, or a physical noise in TRNG). Let us 
finally remark that the vectorial negation satisfies the hypotheses of both theorems above. 

4 Application to Pseudorandomness 
4.1 A First Pseudorandom Number Generator 

We have proposed in |5J a new family of generators that receives two PRNGs as inputs. These two generators 
are mixed with chaotic iterations, leading thus to a new PRNG that improves the statistical properties of 
each generator taken alone. Furthermore, our generator possesses various chaos properties that none of the 
generators used as input present. 

This generator is synthesized in Algorithm[T| It takes as input: a Boolean function / satisfying Theorem[T| 
an integer 6, ensuring that the number of executed iterations is at least b and at most 26 -|- 1; and an initial 
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Algorithm 1: PRNG with chaotic functions 



Input: a function /, an iteration number b, an initial configuration x'^ (n bits) 
Output: a configuration x {n bits) 

X ^ x°; 

k ^ b + XORshiftib); 
for i = 0,...,k do 

s ^ XORshift{n); 

X ^ Ff{s, x); 

return x; 



Algorithm 2: An arbitrary round of XORshift algorithm 
Input: the internal configuration z (a 32-bit word) 
Output: y (a 32-bit word) 

z ^ z © (z < 13); 
z ^ z© (z > 17); 
z ^ z © (z < 5); 
y ^ z; 
return y; 



configuration x". It returns the new generated configuration x. Internally, it embeds two XORshift{k) 
PRNGs [T5] that return integers uniformly distributed into |l;fc]. XORshift is a category of very fast 
PRNGs designed by George Marsaglia, which repeatedly uses the transform of exclusive or (XOR, ©) on a 
number with a bit shifted version of it. This PRNG, which has a period of 2^2 - 1 = 4.29 x 10^, is summed 
up in Algorithm |2] It is used in our PRNG to compute the strategy length and the strategy elements. 

This former generator has successively passed various batteries of statistical tests, as the NIST [2], 
DieHARD [g, and TestUOl [13] ones. 

4.2 Improving the Speed of the Former Generator 

Instead of updating only one cell at each iteration, we can try to choose a subset of components and to 
update them together. Such an attempt leads to a kind of merger of the two sequences used in Algorithm 
[T] When the updating function is the vectorial negation, this algorithm can be rewritten as follows: 

x"e I0,2^-Il,5e l0,2^-ir 

Vn e lN*,x" = a;"-i ©S"", ^ ' 

where © is for the bitwise exclusive or between two integers. This rewriting can be understood as follows. 
The n— th term S" of the sequence S, which is an integer of N binary digits, presents the list of cells to 
update in the state x" of the system (represented as an integer having N bits too) . More precisely, the fc— th 
component of this state (a binary digit) changes if and only if the fc— th digit in the binary decomposition of 
S" is 1. 

The single basic component presented in Eq. [8] is of ordinary use as a good elementary brick in various 
PRNGs. It corresponds to the following discrete dynamical system in chaotic iterations: 

where / is the vectorial negation and Vn £ M, 5" C |1, N] is such that fc e 5" if and only if the fc— th digit 
in the binary decomposition of 5" is 1. Such chaotic iterations are more general than the ones presented in 
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Definition [6] because, instead of updating only one term at each iteration, we select a subset of components 
to change. 

Obviously, replacing Algorithm [l] by Equation [8) which is possible when the iteration function is the 
vectorial negation, leads to a speed improvement. However, proofs of chaos obtained in |3] have been 
established only for chaotic iterations of the form presented in Definition |6] The question is now to determine 
whether the use of more general chaotic iterations to generate pseudorandom numbers faster, does not deflate 
their topological chaos properties. 



4.3 Proofs of Chaos of the General Formulation of the Chaotic Iterations 

Let us consider the discrete dynamical systems in chaotic iterations having the general form: 

if .^5". 

In other words, at the n}^ iteration, only the cells whose id is contained into the set S'" are iterated. 

Let us now rewrite these general chaotic iterations as usual discrete dynamical system of the form ~ 
/(X") on an ad hoc metric space. Such a formulation is required in order to study the topological behavior 
of the system. 

Let us introduce the following function: 



X- [1;N1 x7'(Il;Nl) B 

(11) 

1 if i e X, 



where V {X) is for the powerset of the set X, that is,Y {X) Y d X. 
Given a function / : B'^ — > B'^, define the function: 

Ff : V (II; N]) x B^ — > B'^ 

(12) 



where + and . are the Boolean addition and product operations, and x is the negation of the Boolean x. 
Consider the phase space: 

A- - T' (II; Nl)^ X B^ (13) 

and the map defined on X: 

GfiS,E)^{a{S),Ff{i{S),E)), (14) 

where a is the shift function defined by cr(S'")„6]N £ V (p; N])"^ — > (5"+i)„e]N G V (p; N])"^ and i is the 

initial function i : (S'")„g]N S V (II; N])'^ — >■ S'~' G V (Jl; N]). Then the general chaotic iterations defined 
in Equation [To] can be described by the following discrete dynamical system: 

I X^+i = G/(X'=). 

Once more, a shift function appears as a component of these general chaotic iterations. 
To study the Devaney's chaos property, a distance between two points X — {S, E),Y = {S, E) of X must 
be defined. Let us introduce: 

d{X,Y)^d^{E,E) + d,{S,S), (16) 
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where 

N 

de{E, E) — 5{Ek, Ek) is once more the Haninimg distance, 



fe=i (17) 



N ^ 10^= ' 

k=l 

where |^| is the cardinaHty of a set X and AAB is for the symmetric difference, defined for sets A, B as 
AAB = {A\B)U{B\A). 

Proposition 2 The function d defined in Eq. is a metric on X . 

Proof is the Hamming distance. We will prove that dg is a distance too, thus d, as being the sum of 
two distances, will also be a distance. 

• Obviously, d,{S,S) > 0, and if 5 = 5, then 4(5', S") = 0. Conversely, if ds{S,S) = 0, then V/c £ 
F, 15''= AS'''^! = 0, and so V/c, = 5^ 

• dg is symmetric {ds{S, S) — ds{S, S)) due to the commutative property of the symmetric difference. 

• Finally, |5A5"| = |(5A0)A5"| = |5A(5'A5')A5"| = |(5A5')A(5'A5")| |5A5'| + |5'A5"|, and 
so for all subsets S, 5', and S" of [1, N], we have d,{S, S") < de(5, 5') + d,(5', 5"), and the triangle 
inequality is obtained. 

Before being able to study the topological behavior of the general chaotic iterations, we must first establish 
that: 

Proposition 3 For all f : — > B^, the function Gf is continuous on {X,d). 

Proof We use the sequential continuity. Let (S'", i!^")„giN be a sequence of the phase space X, which 
converges to {S,E). We will prove that (^G f {S" , E^)) ^^-^ converges to (G/(5, £')). Let us remark that for 
all n, 5" is a strategy, thus, we consider a sequence of strategies (i.e., a sequence of sequences). 
As d{{S",E"); {S,E)) converges to 0, each distance de{E"-,E) and 4(5", 5) converges to 0. But de{E''',E) 
is an integer, so 3no G M, de{E", E) = for any uq. 

In other words, there exists a threshold no G 1^ after which no cell will change its state: 3no G M, n ^ no =^ 
E" = E. 

In addition, (is(5",5) — > 0, so 3ni e IN, 4(5", 5) < 10~^ for all indexes greater than or equal to ni. 
This means that for n > ni, all the 5" have the same first term, which is 5°: Vn ^ ni, 5o = 5o. 

Thus, after the max{no, ni)*'* term, states of E" and E are identical and strategies 5" and 5 start with 
the same first term. 

Consequently, states of G/(5",£'") and Gf{S,E) are equal, so, after the max{no,niY^ term, the distance 
d between these two points is strictly less than 1. 

We now prove that the distance between (G/(5", £^")) and (G/(5, i?)) is convergent to 0. Let e > 0. 

• If e ^ 1, we see that the distance between (G/(5",i?")) and (G/(5, £')) is strictly less than 1 after 
the max{nQ,niY^ term (same state). 

• If e < 1, then 3k e IN, 10"'= ^ £ > lO^C^+^l But 4(5", 5) converges to 0, so 

3n2 e ]N,Vn > n2,4(5",5) < lQ-^''+^\ 
thus after n2, the fe + 2 first terms of 5" and 5 are equal. 
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As a consequence, the fc + 1 first entries of the strategies of Gf{S"', E^) and Gf{S, E) are the same (G/ is 
a shift of strategies) and due to the definition of ds, the floating part of the distance between (S*", i?") and 
{S,E) is strictly less than lO^^'^+i) < e. 

In conclusion, 

Ve > 0,3Nq = max{no,ni,n2) G lNf,Vn ^ Nq, d {Gf{S'' , E""); Gf{S, E)) e. 
G/ is consequently continuous. 

It is now possible to study the topological behavior of the general chaotic iterations. We will prove that. 
Theorem 3 The general chaotic iterations defined on Equation \10{ satisfy the Devaney's property of chaos. 

Let us firstly prove the following lemma. 

Lemma 1 (Strong transitivity) For all couples X,Y £ X and any neighborhood V of X, we can find 
new and X' e V such that G"(X') = Y. 

Proof Let X = {S,E), e > 0, and ko = [logio{e) + IJ. Any point X' = {S',E') such that E' = E and 

V/c < fco, S'^ = S^, are in the open ball B {X, e). Let us define X = {s, E^ , where X = G^'>{X). We denote 

by s C |1; N] the set of coordinates that are different between E and the state of Y . Thus each point X' of 
the form (S", E') where E' — E and S' starts with (5°, S*^, . . . , S^" , s, . . .), verifies the following properties: 

• X' is mB{X,e), 

• the state of Gf+'^{X') is the state of Y. 

Finally the point (^{S°, S^,. . . , S''°,s, s°, s\ . . .) ; i?^ , where (s°, s\ . . .) is the strategy of Y, satisfies the 
properties claimed in the lemma. 

We can now prove Theorem [S].. 

Proof (Theorem |3]) Firstly, strong transitivity implies transitivity. 

Let {S, E) e X and e > 0. To prove that G/ is regular, it is sufficient to prove that there exists a strategy 
S such that the distance between {S,E) and {S,E) is less than e, and such that {S,E) is a periodic point. 

Let ti — [— log]^o(£)J ; ^'^id let E' be the configuration that we obtain from {S,E) after ti iterations of 
Gf. As Gf is strongly transitive, there exists a strategy S' and ^2 G IN such that E is reached from (S", E') 
after t2 iterations oi Gf. 

Consider the strategy S that alternates the first ti terms of S and the first t2 terms of S": 

S — {Sq, . . . , St-^-i, 5*0, ... , S[^_i, So, ■ ■ . , St-^-i, 5*0, ... , S'f^_i, Sq, . . .). 

It is clear that {S,E) is obtained from {S,E) after ti + t2 iterations oi Gf. So {S,E) is a periodic point. 
Since St — St for t < ti, by the choice of ti, we have d{{S,E), {S,E)) < e. 

5 Efficient PRNG based on Chaotic Iterations 

Based on the proof presented in the previous section, it is now possible to improve the speed of the generator 
formerly presented in [5, ,4 . The first idea is to consider that the provided strategy is a pseudorandom 
Boolean vector obtained by a given PRNG. An iteration of the system is simply the bitwise exclusive or 
between the last computed state and the current strategy. Topological properties of disorder exhibited by 
chaotic iterations can be inherited by the inputted generator, we hope by doing so to obtain some statistical 
improvements while preserving speed. 

Let us give an example using 16-bits numbers, to clearly understand how the bitwise xor operations are 
done. Suppose that x and the strategy S** are given as binary vectors. Table [l] shows the result of x S*'. 
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X = 


1011101010010010 




0110011011100111 


x®S' = 


1101110001110101 



Table 1: Example of an arbitrary round of the proposed generator 



Listing 1: C code of the sequential PRNG based on chaotic iteration s 

unsigned int CIPRNG() { 

static unsigned int x = 123123123; 

unsigned long tl = xorshift(); 

unsigned long t2 = xorl28(); 

unsigned long t3 = xorwow ( ) ; 

X = x" (unsigned int)tl; 

X = x"(unsigned int ) ( t2 > >32) ; 

X = x"(unsigned int ) ( t3 > >32) ; 

X = x" (unsigned int)t2; 

X = x"(unsigned int ) ( 1 1 > >32) ; 

X = x" (unsigned int)t3; 

return x; 

} 

In Listing [T] a sequential version of the proposed PRNG based on chaotic iterations is presented. The 
xor operator is represented by This function uses three classical 64-bits PRNGs, namely the xorshift, 
the xor 128, and the xorwow fT5^. In the following, we call them "xor-like PRNGs". As each xor-like PRNG 
uses 64-bits whereas our proposed generator works with 32-bits, we use the command (unsigned int) , that 
selects the 32 least significant bits of a given integer, and the code (unsigned int) (t>>32) in order to 
obtain the 32 most significant bits of t. 

Thus producing a pseudorandom number needs 6 xor operations with 6 32-bits numbers that are provided 
by 3 64-bits PRNGs. This version successfully passes the stringent BigCrush battery of tests [13]. 

6 Efficient PRNGs based on Chaotic Iterations on GPU 

In order to take benefits from the computing power of GPU, a program needs to have independent blocks of 
threads that can be computed simultaneously. In general, the larger the number of threads is, the more local 
memory is used, and the less branching instructions are used (if, while, ...), the better the performances on 
GPU is. Obviously, having these requirements in mind, it is possible to build a program similar to the one 
presented in Listing [T] which computes pseudorandom numbers on GPU. To do so, we must firstly recall 
that in the CUDA |16, environment, threads have a local identifier called Threadldx, which is relative to 
the block containing them. Furthermore, in CUDA, parts of the code that are executed by the GPU, are 
called kernels. 

6.1 Naive Version for GPU 

It is possible to deduce from the CPU version a quite similar version adapted to GPU. The simple principle 
consists in making each thread of the GPU computing the CPU version of our PRNG. Of course, the 
three xor-like PRNGs used in these computations must have different parameters. In a given thread, these 
parameters are randomly picked from another PRNGs. The initialization stage is performed by the CPU. 
To do it, the ISAAC PRNG [12] is used to set all the parameters embedded into each thread. 

The implementation of the three xor-like PRNGs is straightforward when their parameters have been 
allocated in the GPU memory. Each xor-like works with an internal number x that saves the last generated 
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pseudorandom number. Additionally, the implementation of the xorl28, the xorshift, and the xorwow 
respectively require 4, 5, and 6 unsigned long as internal variables. 



Algorithm 3: Main kernel of the GPU "naive" version of the PRNG based on chaotic iterations 
Input: Internal VarXorLike Array: array with internal variables of the 3 xor-like PRNGs in global 

memory; 
NumThreads: number of threads; 

Output: NewNb: array containing random numbers in global memory 
if threadldx is concerned by the computation then 

retrieve data from InternalVarXorLikeArray[threadIdx] in local variables; 

for i=l to n do 

compute a new PRNG as in Listing 

store the new PRNG in NewNb[NumThreads*threadIdx+i]; 
store internal variables in InternalVarXorLikeArray [threadldx]; 



Algorithm [3] presents a naive implementation of the proposed PRNG on GPU. Due to the available 
memory in the GPU and the number of threads used simultaneously, the number of random numbers that 
a thread can generate inside a kernel is limited (i.e., the variable n in algorithm [s]) . For instance, if 100,000 
threads are used and if n — lOCQ then the memory required to store all of the internals variables of both 
the xor-like PRNGfj^and the pseudorandom numbers generated by our PRNG, is equal to 100, 000 x ((4 + 
5 + 6) X 2 + (1 + 100)) 1, 310, 000 32-bits numbers, that is, approximately 52Mb. 

This generator is able to pass the whole BigCrush battery of tests, for all the versions that have been 
tested depending on their number of threads (called NumThreads in our algorithm, tested up to 5 million). 

Remark 1 The proposed algorithm has the advantage of manipulating independent PRNGs, so this version 
is easily adaptable on a cluster of computers too. The only thing to ensure is to use a single ISAAC PRNG. 
To achieve this requirement, a simple solution consists in using a master node for the initialization. This 
master node computes the initial parameters for all the different nodes involved in the computation. 

6.2 Improved Version for GPU 

As GPU cards using CUDA have shared memory between threads of the same block, it is possible to use 
this feature in order to simplify the previous algorithm, i.e., to use less than 3 xor-like PRNGs. The solution 
consists in computing only one xor-like PRNG by thread, saving it into the shared memory, and then to 
use the results of some other threads in the same block of threads. In order to define which thread uses the 
result of which other one, we can use a combination array that contains the indexes of all threads and for 
which a combination has been performed. 

In Algorithm^ two combination arrays are used. The variable offset is computed using the value of 
combination_size. Then we can compute ol and o2 representing the indexes of the other threads whose 
results are used by the current one. In this algorithm, we consider that a 32-bits xor-like PRNG has been 
chosen. In practice, we use the xorl28 proposed in [13] in which unsigned longs (64 bits) have been replaced 
by unsigned integers (32 bits). 

This version can also pass the whole BigCrush battery of tests. 

6.3 Theoretical Evaluation of the Improved Version 

A run of Algorithm |4] consists in an operation {x — x(Bt) having the form of Equation [s] which is equivalent 
to the iterative system of Eq. [9] That is, an iteration of the general chaotic iterations is realized between 

^in fact, we need to add the initial seed (a 32-bits number) 

^we multiply this number by 2 in order to count 32-bits numbers 
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Algorithm 4: Main kernel for the chaotic iterations based PRNG GPU efficient version 



Input: Internal VarXorLike Array: array with internal variables of 1 xor-like PRNGs in global 

memory; 
NumThreads: Number of threads; 

array_combl, array_comb2: Arrays containing combinations of size combination_size; 
Output: NewNb: array containing random numbers in global memory 
if threadid is concerned then 

retrieve data from InternalVarXorLikeArray[threadId] in local variables including shared memory 

and x; 

offset = threadIdx%combination_size; 

01 = threadIdx-offset+array_combl[offset]; 

02 = threadIdx-offset+array_comb2[offset]; 
for i=l to n do 

t=xor-like(); 

t=t ~ shmem[ol] "shmem[o2] ; 
shared _mem[threadld] =t ; 
X = x"t; 

store the new PRNG in NewNb[NumThreads*threadId+i]; 
store internal variables in InternalVarXorLikeArray[threadId]; 



the last stored value x of the thread and a strategy t (obtained by a bitwise exclusive or between a value 
provided by a xor-like() call and two values previously obtained by two other threads). To be certain that 
we are in the framework of Theorem [3j we must guarantee that this dynamical system iterates on the space 
X = r (II, N]) X B^. The left ter m X obviously belongs to B'^. To prevent from any flaws of chaotic 
properties, we must check that the right term (the last t), corresponding to the strategies, can possibly be 
equal to any integer of [[1, N]. 

Such a result is obvious, as for the xor-like(), all the integers belonging into its interval of definition can 
occur at each iteration, and thus the last t respects the requirement. Furthermore, it is possible to prove 
by an immediate mathematical induction that, as the initial x is uniformly distributed (it is provided by 
a cryptographically secure PRNG), the two other stored values shmem[ol] and shmem[o2] are uniformly 
distributed too, (this is the induction hypothesis), and thus the next x is finally uniformly distributed. 

Thus Algorithm [4] is a concrete realization of the general chaotic iterations presented previously, and for 
this reason, it satisfies the Devaney's formulation of a chaotic behavior. 



7 Experiments 

Different experiments have been performed in order to measure the generation speed. We have used a first 
computer equipped with a Tesla C1060 NVidia GPU card and an Intel Xeon E5530 cadenced at 2.40 GHz, 
and a second computer equipped with a smaller CPU and a GeForce GTX 280. All the cards have 240 cores. 

In Figure [l] we compare the quantity of pseudorandom numbers generated per second with various xor- 
like based PRNGs. In this figure, the optimized versions use the xor64 described in [15 , whereas the 
naive versions embed the three xor-like PRNGs described in Listing [T] In order to obtain the optimal 
performances, the storage of pseudorandom numbers into the GPU memory has been removed. This step 
is time consuming and slows down the numbers generation. Moreover this storage is completely useless, in 
case of applications that consume the pseudorandom numbers directly after generation. We can see that 
when the number of threads is greater than approximately 30,000 and lower than 5 million, the number of 
pseudorandom numbers generated per second is almost constant. With the naive version, this value ranges 
from 2.5 to 3GSamples/s. With the optimized version, it is approximately equal to 20GSamples/s. Finally 
we can remark that both GPU cards are quite similar, but in practice, the Tesla C1060 has more memory 
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than the GTX 280, and this memory should be of better quality. As a comparison, Listing [T] leads to the 
generation of about 138MSample/s when using one core of the Xeon E5530. 
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Figure 1: Quantity of pseudorandom numbers generated per second with the xorlike-based PRNG 

In Figure [2] we highlight the performances of the optimized BBS-based PRNG on GPU. On the Tesla 
C1060 we obtain approximately 700MSample/s and on the GTX 280 about 670MSample/s, which is obviously 
slower than the xorlike-based PRNG on GPU. However, we will show in the next sections that this new PRNG 
has a strong level of security, which is necessarily paid by a speed reduction. 

All these experiments allow us to conclude that it is possible to generate a very large quantity of pseudo- 
random numbers statistically perfect with the xor-like version. To a certain extend, it is also the case with 
the secure BBS-based version, the speed deflation being explained by the fact that the former version has 
"only" chaotic properties and statistical perfection, whereas the latter is also cryptographically secure, as it 
is shown in the next sections. 



8 Security Analysis 

In this section the concatenation of two strings u and v is classically denoted by uv. In a cryptographic 
context, a pseudorandom generator is a deterministic algorithm G transforming strings into strings and such 
that, for any seed s of length m, G{s) (the output of G on the input s) has size ici^) with iQ^m) > m. 
The notion of secure PRNGs can now be defined as follows. 

Definition 7 A cryptographic PRNG G is secure if for any probabilistic polynomial time algorithm D, for 
any positive polynomial p, and for all sufficiently large rn's, 

\PT[D{G{U,n)) - 1] - Pr[i?(C/,^(„)) = 1]\<-J— 

where Ur is the uniform distribution over {0, l}*" and the probabilities are taken over [/„i, t^£G(ni) ^gII as 
over the internal coin tosses of D. 
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Figure 2: Quantity of pseudorandom numbers generated per second using the BBS-based PRNG 



Intuitively, it means that there is no polynomial time algorithm that can distinguish a perfect uniform 
random generator from G with a non negligible probability. The interested reader is referred to pTl chapter 3] 
for more information. Note that it is quite easily possible to change the function £ into any polynomial 
function £' satisfying i'{m) > m) [TTJ Chapter 3.3]. 

The generation schema developed in ([8| is based on a pseudorandom generator. Let if be a cryptographic 
PRNG. We may assume, without loss of generality, that for any string of size N, the size of H{Sq) is kN, 
with A: > 2. It means that £h{N) = kN . Let Si, . . . ,Skhe the strings of length N such that H{Sq) = Si . . . Sk 
{H{So) is the concatenation of the Si's). The cryptographic PRNG X defined in (|8| is the algorithm mapping 
any string of length 27V xqSq into the string {xq ® Sq ® Si){xo ® Sq ® Si ® S2) ■ ■ ■ {xo -^^ ■^'O- One in 



particular has ix{2N) 
secure too. 



kN = £h{N). We claim now that if this PRNG is secure, then the new one is 



Proposition 4 If H is a secure cryptographic PRNG, then X is a secure cryptographic PRNG too. 

Proof The proposition is proved by contraposition. Assume that X is not secure. By Definition, there 
exists a polynomial time probabilistic algorithm D, a positive polynomial p, such that for all fco there exists 
N > ^ satisfying 



\PliD{X{U2N)) = 1] - P4D{UkN = 1]| > 



1 



p{2N) ■ 

We describe a new probabilistic algorithm D' on an input w of size kN: 

1. Decompose w into w — wi . . . Wk, where each Wi has size N. 

2. Pick a string y of size N uniformly at random. 

3. Compute z = (y © wi){y © wi ® W2) ■ . ■ w^). 

4. Return D{z). 
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Consider for each y G B the function ipy from B into B mapping w — wi . . .Wk (each Wi has 
length N) to (y © wi)(y ® wi® W2) ■ ■ ■ {y '^O- -By construction, one has for every w, 

D'{w) = D{^y{w)), (18) 

where y is randomly generated. Moreover, for each y, Lpy is injective: if {y®wi){y(Bwi®W2) ■ ■ ■ {y ©^=1^ Wi) — 
{y © w[){y © w[ © • ■ ■ {y®]Zi ^D' t^'^n for every 1 < j < k, y ^]z{ w- = 2/0 -Ii Wi. It follows, by a 
direct induction, that Wi — w[. Furthermore, since B*^^ is finite, each (fy is bijective. Therefore, and using 
( 18 1 , one has 

VY[D'{UkN) = 1] = VY[D{ipy{UuN)) = 1] = VY[D{UkN) = 1]. (19) 



Now, using ( 18 1 again, one has for every x, 

D'{H{x)) = D{^y{H{x))), (20) 
where y is randomly generated. By construction, ipy{H{x)) — X{yx), thus 

D'{H{x)) - D{yx), (21) 
where y is randomly generated. It follows that 

Vt[D'{H{Un)) = 1] = Pr[i?(C/2w) = 1]. (22) 



From ( 19 ) and ( 22 1 , one can deduce that there exists a polynomial time probabilistic algorithm D' , a positive 
polynomial p, such that for all fcp there exists N > ^ satisfying 

\Pt[D{H{Un)) - 1] - PriDiUkN = 1]| > 



p{2N) 

proving that H is not secure, which is a contradiction. 



9 Cryptographical Applications 

9.1 A Cryptographically Secure PRNG for GPU 

It is possible to build a cryptographically secure PRNG based on the previous algorithm ( Algorithm |4|. Due 
to Proposition [4] it simply consists in replacing the xor-like PRNG by a cryptographically secure one. We 
have chosen the Blum Blum Shum generator ^ (usually denoted by BBS) having the form: 

Xn+i — x\ mod M 

where is the product of two prime numbers (these prime numbers need to be congruent to 3 modulus 4) . 
BBS is known to be very slow and only usable for cryptographic applications. 

The modulus operation is the most time consuming operation for current GPU cards. So in order to obtain 
quite reasonable performances, it is required to use only modulus on 32-bits integer numbers. Consequently 
cc^ need to be lesser than 2^^^, and thus the number M must be lesser than 2^^. So in practice we can choose 
prime numbers around 256 that are congruent to 3 modulus 4. With 32-bits numbers, only the 4 least 
significant bits of Xn can be chosen (the maximum number of indistinguishable bits is lesser than or equals 
to log2{log2{M))) . In other words, to generate a 32-bits number, we need to use 8 times the BBS algorithm 
with possibly different combinations of M. This approach is not sufficient to be able to pass all the tests of 
TestUOl, as small values of M for the BBS lead to small periods. So, in order to add randomness we have 
proceeded with the foUowings modifications. 
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• Firstly, we define 16 arrangement arrays instead of 2 (as described in Algorithm |4| , but only 2 of them 
are used at each call of the PRNG kernels. In practice, the selection of combination arrays to be used 
is different for all the threads. It is determined by using the three last bits of two internal variables 
used by BBS. In Algorithm|5] character & is for the bitwise AND. Thus using &7 with a number gives 
the last 3 bits, thus providing a number between and 7. 

• Secondly, after the generation of the 8 BBS numbers for each thread, we have a 32-bits number whose 
period is possibly quite small. So to add randomness, we generate 4 more BBS numbers to shift the 
32-bits numbers, and add up to 6 new bits. This improvement is described in Algorithm|5] In practice, 
the last 2 bits of the first new BBS number are used to make a left shift of at most 3 bits. The last 3 
bits of the second new BBS number are added to the strategy whatever the value of the first left shift. 
The third and the fourth new BBS numbers are used similarly to apply a new left shift and add 3 new 
bits. 

• Finally, as we use 8 BBS numbers for each thread, the storage of these numbers at the end of the kernel 
is performed using a rotation. So, internal variable for BBS number 1 is stored in place 2, internal 
variable for BBS number 2 is stored in place 3, and finally, internal variable for BBS number 8 is 
stored in place 1. 

In Algorithm |5] n is for the quantity of random numbers that a thread has to generate. The operation 
t«=4 performs a left shift of 4 bits on the variable t and stores the result in t, and BBSl{bbsl)Szl5 selects 
the last four bits of the result of BBSl. Thus an operation of the form t <<~ 4;t| = BBSl{bbsl)&zl5 
realizes in t a left shift of 4 bits, and then puts the 4 last bits of BBSl{bbsl) in the four last positions of t. 
Let us remark that the initialization t is not a necessity as we fill it 4 bits by 4 bits, until having obtained 
32-bits. The two last new shifts are realized in order to enlarge the small periods of the BBS used here, 
to introduce a kind of variability. In these operations, we make twice a left shift of t of at most 3 bits, 
represented by shift in the algorithm, and we put exactly the shift last bits from a BBS into the shift 
last bits of t. For this, an array named array_shif t, containing the correspondence between the shift and 
the number obtained with shift 1 to make the and operation is used. For example, with a left shift of 0, 
we make an and operation with 0, with a left shift of 3, we make an and operation with 7 (represented by 
111 in binary mode). 

It should be noticed that this generator has once more the form a;"+^ — x" ® S", where S" is referred in 
this algorithm as t: each iteration of this PRNG ends with x = x At. This S"" is only constituted by secure 
bits produced by the BBS generator, and thus, due to Proposition |4] the resulted PRNG is cryptographically 
secure. 

9.2 Toward a Cryptographically Secure and Chaotic Asymmetric Cryptosystem 

We finish this research work by giving some thoughts about the use of the proposed PRNG in an asymmetric 
cryptosystem. This first approach will be further investigated in a future work. 

9.2.1 Recalls of the Blum-Goldwasser Probabilistic Cryptosystem 

The Blum-Goldwasser cryptosystem is a cryptographically secure asymmetric key encryption algorithm 
proposed in 1984 j^. The encryption algorithm implements a XOR-based stream cipher using the BBS 
PRNG, in order to generate the keystream. Decryption is done by obtaining the initial seed thanks to the 
final state of the BBS generator and the secret key, thus leading to the reconstruction of the keystream. 

The key generation consists in generating two prime numbers (p, q) , randomly and independently of each 
other, that are congruent to 3 mod 4, and to compute the modulus N = pq. The public key is N, whereas 
the secret key is the factorization {p, q) . 

Suppose Bob wishes to send a string m = (mg, . . . , m^^i) of L bits to Alice: 

1. Bob picks an integer r randomly in the interval |1, N\ and computes xq = mod N. 
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Algorithm 5: main kernel for the BBS based PRNG GPU 



Input: InternalVarBBS Array: array with internal variables of the 8 BBS in global memory; 
NumThreads: Number of threads; 

array_comb: 2D Arrays containing 16 combinations (in first dimension) of size combination_size (in 

second dimension); 
array_shift[4]={0,l,3,7}; 

Output: NewNb: array containing random numbers in global memory 

if threadid is concerned then 

retrieve data from InternalVarBBSArray[threadId] in local variables including shared memory and 
x; 

we consider that bbsl ... bbs8 represent the internal states of the 8 BBS numbers; 
offset = threadIdx%combination_size; 

01 = threadIdx-offset+array_comb[bbsl&7][offset]; 

02 = threadIdx-offset+array_comb[8+bbs2& 7] [offset]; 
for i=l to n do 

t«=4; 

thBBSl(bbsl)&15; 

t«=4; 

t|=BBS8(bbs8)&15: 
// two new shifts 
shift=BBS3(bbs3)&3; 

t<<=shift; 

1 1 =BBS 1 (bbs 1) fearray _shift [shift] ; 
shift=BBS7(bbs7)&3; 

t<<=shift; 

t|=BBS2(bbs2)&array_shift[shift]; 
t =t " shmem [o 1 ] " shmem [o2] ; 
shared_mem[threadld]=t; 

X = x"t; 

store the new PRNG in NewNb[NumThreads*threadId+i]; 
store internal variables in InternalVarXorLikeArray[threadId] using a rotation; 
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2. He uses the BBS to generate the keystream of L pseudorandom bits (60, ■ • • as follows. For 
j = to L - 1, 

• While i < i - 1: 

— Set bi equal to the least-significant|^ bit of Xi, 

— i = i + l, 

— Xi — (xi^i)'^ mod N. 

3. The ciphertext is computed by XORing the plaintext bits m with the keystream: c = (cq, . . . , cl-i) = 
m(B b. This ciphertext is [c, y] , where y — Xq mod N. 

When Alice receives [(cq, . . . , c^^i), ?/] , she can recover m as follows: 

1. Using the secret key {p, q), she computes Vp = mod p and Vq = y(('J+i)/4)^ mod q. 

2. The initial seed can be obtained using the following procedure: xq ~ q{q^^ mod p)rp+p{p^^ mod q)rq mod N . 

3. She recomputes the bit- vector b by using BBS and xq. 

4. Alice finally computes the plaintext by XORing the keystream with the ciphertext: m = cO b. 

9.2.2 Proposal of a new Asymmetric Cryptosystem Adapted from Blum-Goldwasser 

We propose to adapt the Blum-Goldwasser protocol as follows. Let N — [log{log{N))\ be the number of 
bits that can be obtained securely with the BBS generator using the public key N of Alice. Alice will pick 
randomly 5*° in JO, 2'^^^] too, and her new public key will be (S"", N). 
To encrypt his message. Bob will compute 

c = (mo ® (5o ® S°),mi ® {bo ® 61 ® S°), mL-i ® (60 ® 5i . . . ® bL-i ® 5°)) (23) 

instead of (mo ® bo, mi ® 61, ... , mL-i ® foi-i). 

The same decryption stage as in Blum-Goldwasser leads to the sequence (mo ® 5'°, mi ® 5'°, . . . , m^-i ® S'°) . 
Thus, with a simple use of 5'", Alice can obtain the plaintext. By doing so, the proposed generator is used 
in place of BBS, leading to the inheritance of all the properties presented in this paper. 

10 Conclusion 

In this paper, a formerly proposed PRNG based on chaotic iterations has been generalized to improve its 
speed. It has been proven to be chaotic according to Devaney. Efficient implementations on GPU using 
xor-like PRNGs as input generators have shown that a very large quantity of pseudorandom numbers can be 
generated per second (about 20Gsamples/s), and that these proposed PRNGs succeed to pass the hardest 
battery in TestUOl, namely the BigCrush. Furthermore, we have shown that when the inputted generator 
is cryptographically secure, then it is the case too for the PRNG we propose, thus leading to the possibility 
to develop fast and secure PRNGs using the GPU architecture. Thoughts about an improvement of the 
Blum-Goldwasser cryptosystem, using the proposed method, has been finally proposed. 

In future work we plan to extend these researches, building a parallel PRNG for clusters or grid computing. 
Topological properties of the various proposed generators will be investigated, and the use of other categories 
of PRNGs as input will be studied too. The improvement of Blum-Goldwasser will be deepened. Finally, 
we will try to enlarge the quantity of pseudorandom numbers generated per second either in a simulation 
context or in a cryptographic one. 

■^As signaled previously, BBS can securely output up to N = \log{log{N))\ of the least-significant bits of Xi during each 
round. 



18 



References 



[1] Y. Kholodov A. Zhmurov, K. Rybnikov and V. Barsegov. Generation of random numbers on graphics 
processors: Forced indentation in silico of the bacteriophage hk97. J. Phys. Chem. B, 115(18):5278-5288, 
2011. 

[2] Jacques M. Bahi, Jean-frangois Couchot, Christophe Guyeux, and Adrien Richard. On the Unk between 
strongly connected iteration graphs and chaotic boolean discrete-time dynamical systems. In FCT'll, 
18th Int. Symp. on Fundamentals of Computation Theory, volume * of LNCS, pages Oslo, 

Norway, August 2011. To appear. 

[3] Jacques M. Bahi and Christophe Guyeux. Hash functions using chaotic iterations. Journal of Algorithms 
& Computational Technology, 4(2):167-181, 2010. 

[4] Jacques M. Bahi and Christophe Guyeux. Topological chaos and chaotic iterations, application to hash 
functions. In WCCI'IO, IEEE World Congress on Computational Intelligence, pages 1-7, Barcelona, 
Spain, July 2010. Best paper award. 

[5] Jacques M. Bahi, Christophe Guyeux, and Qianxue Wang. A novel pseudo-random generator based 
on discrete chaotic iterations. In INTERNET'09, 1-st Int. Conf. on Evolving Internet, pages 71-76, 
Cannes, Prance, August 2009. 

[6] J. Banks, J. Brooks, G. Cairns, and R Stacey. On devaney's definition of chaos. Amer. Math. Monthly, 
99:332-334, 1992. 

[7] E. Barker and A. Roginsky. Draft nist special publication 800-131 recommendation for the transitioning 

of cryptographic algorithms and key sizes, 2010. 

[8] Lenore Blum, Manuel Blum, and Michael Shub. A simple unpredictable pseudo-random number gener- 
ator. SIAM Journal on Computing, 15:364-383, 1986. 

[9] Manuel Blum and Shafi Goldwasser. An efficient probabilistic public key encryption scheme which hides 
all partial information. In Proceedings of CRYPTO 84 on Advances in cryptology, pages 289-302, New 
York, NY, USA, 1985. Springer- Verlag New York, Inc. 

[10] Robert L. Devaney. An Introduction to Chaotic Dynamical Systems. Addison- Wesley, Redwood City, 

CA, 2nd edition, 1989. 

[11] Oded Goldreich. Foundations of Cryptography: Basic Tools. Cambridge University Press, 2007. 

]12] Jenkins. ISAAC. In IWFSE: International Workshop on Fast Software Encryption, LNCS, 1996. 

[13] Pierre L'Ecuyer and Richard J. Simard. TestUOl: A C library for empirical testing of random number 
generators. ACM Trans. Math. Softw, 33(4), 2007. 

[14] G. Marsagha. Diehard: a battery of tests of randomness, http://stat.fsu.edu/ geo/ diehard.html, 1996. 

[15] G. Marsagiia. Xorshift rngs. Journal of Statistical Software, 8(14):l-6, 2003. 

[16] Nvidia. Cuda cuhlas library, 2011. Version 4.0. 

[17] Nvidia. Curand library, 2011. Version 4.0. 

[18] Wai-Man Pang, Tien-Tsin Wong, and Pheng-Ann Heng. Generating massive high-quality random num- 
bers using GPU. In Jun Wang, editor, 2008 IEEE World Congress on Computational Intelligence, Hong 
Kong, 2008. IEEE Computational IntelUgence Society, IEEE Press. 

[19] F. Robert. Discrete Iterations: A Metric Study, volume 6 of Springer Series in Computational Mathe- 
matics. 1986. 



19 



[20] David B. Thomas, Lcc W. Howes, and Wayne Luk. A comparison of CPUs, CPUs, FPGAs, and 
massively parallel processor arrays for random number generation. In Paul Chow and Peter Y. K. 
Cheung, editors, Proceedings of the ACM/SIGDA 17th International Symposium on Field Programmable 
Gate Arrays, FPGA 2009, Monterey, California, USA, February 22-24, 2009, pages 63-72. ACM, 2009. 



20 



